From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from mails.dpdk.org (mails.dpdk.org [217.70.189.124]) by inbox.dpdk.org (Postfix) with ESMTP id 9073D457A1 for ; Mon, 12 Aug 2024 14:59:41 +0200 (CEST) Received: from mails.dpdk.org (localhost [127.0.0.1]) by mails.dpdk.org (Postfix) with ESMTP id 8B17540A67; Mon, 12 Aug 2024 14:59:41 +0200 (CEST) Received: from NAM04-MW2-obe.outbound.protection.outlook.com (mail-mw2nam04on2040.outbound.protection.outlook.com [40.107.101.40]) by mails.dpdk.org (Postfix) with ESMTP id A761440A4B for ; Mon, 12 Aug 2024 14:59:40 +0200 (CEST) ARC-Seal: i=1; a=rsa-sha256; s=arcselector10001; d=microsoft.com; cv=none; b=TflorLjBHoRSG3YRiHBDoeTi8hdGqJ4/dO7+TrHU02zZjLg8AjJqX7n/vF+LZQDyZPif8Xo1FDoZgi64Q1/v2/pfrLlPtdf2ILrVedKMUneeCsBH98dNtbQSk1TeITq5P5hi6p2nY45UAuNzc2ztRv8oRvjQK01EqaTKx4NrZFCSTywJ9Z+M8eE2Q1EPGA1fXR4cyWi1E0WOCI9dUaBINF+bTfhMgun/TAESm/pTOJyyIZCx6pbL6Alt2ohkndyQIz+1/swIiEe+9qIxEotIi32o0nmbTL0snWVzlHzhdmsMYCv6RZP+gpKMl5ZlqUwCdjTi9IB4HBcZ0AsWmu7Png== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector10001; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1; bh=S7xY3FhXjeKEzZ6gc+IBI9eP7QXGIU2YqJJQiCdCYTI=; b=OEviO8rpzKS/yMKLZNq+8V8UCENlYrYCVRwJ+HQu7m5XbLmdz8yQjgcozT+g8+r/bHn9P1qNnPUS/ANCUrO9k6dFj7EnmykW48gd1XDNXf7dvH704vViNTo4IB7gvZXSIlbKQmQlZ7t/FRZQOhd8PS3UFiDgWjaGDfRxmru1aqJ/kM7UOqdmBin+4Jo7X2aCK+S6LgVvUHO3Qf8/8bqg8EaAQ++8zDZMdQlCzOWwht2RTe5uo3UYSB6YN3NLL0ovKOSrD95KxpHNTZsxHrVoWeYNKuMF1PobuIWu25hVGppTcbmOL022ddd7HyZ8sGqqaNT4HsoREIRwUNXnjjQuYA== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass (sender ip is 216.228.117.160) smtp.rcpttodomain=amd.com smtp.mailfrom=nvidia.com; dmarc=pass (p=reject sp=reject pct=100) action=none header.from=nvidia.com; dkim=none (message not signed); arc=none (0) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=Nvidia.com; s=selector2; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=S7xY3FhXjeKEzZ6gc+IBI9eP7QXGIU2YqJJQiCdCYTI=; b=bKt9GkTyroL4X+mRqoj70+qiyYbyz1L/4tfh6FgDOuNkNFJDVMqkRWzwG147i8WEKjrWI4W/AoPH7vqVkqMrlS/ihb1lqYQuXtCkpb70MNmosDRMAV51PJtLAKeqkfD1H9fGX/7iulr8X3CyKkKukyKLvw5AX7uMc4QelmorPy7RV1/0Fm3nlOn93wrn9KehsdLxYSG9h0nX4OnhmG2EOfKMf+guuzeKbaoBY2b/fmpBx52nmbuB1QyCOOZcxGeNlJqPyehWF/NaOh5gTU8dmRFhmopyXHjwwzABy6BB/GnEuW15SCBKW1ZnoPPvGad2E/Y98Fpy7TDNaZF9l1GRKw== Received: from BL0PR02CA0064.namprd02.prod.outlook.com (2603:10b6:207:3d::41) by SJ2PR12MB8182.namprd12.prod.outlook.com (2603:10b6:a03:4fd::20) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.7849.20; Mon, 12 Aug 2024 12:59:37 +0000 Received: from BL02EPF0001A0FE.namprd03.prod.outlook.com (2603:10b6:207:3d:cafe::39) by BL0PR02CA0064.outlook.office365.com (2603:10b6:207:3d::41) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.7849.20 via Frontend Transport; Mon, 12 Aug 2024 12:59:36 +0000 X-MS-Exchange-Authentication-Results: spf=pass (sender IP is 216.228.117.160) smtp.mailfrom=nvidia.com; dkim=none (message not signed) header.d=none;dmarc=pass action=none header.from=nvidia.com; Received-SPF: Pass (protection.outlook.com: domain of nvidia.com designates 216.228.117.160 as permitted sender) receiver=protection.outlook.com; client-ip=216.228.117.160; helo=mail.nvidia.com; pr=C Received: from mail.nvidia.com (216.228.117.160) by BL02EPF0001A0FE.mail.protection.outlook.com (10.167.242.105) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.7828.19 via Frontend Transport; Mon, 12 Aug 2024 12:59:36 +0000 Received: from rnnvmail201.nvidia.com (10.129.68.8) by mail.nvidia.com (10.129.200.66) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.2.1544.4; Mon, 12 Aug 2024 05:59:22 -0700 Received: from nvidia.com (10.126.231.35) by rnnvmail201.nvidia.com (10.129.68.8) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.2.1544.4; Mon, 12 Aug 2024 05:59:20 -0700 From: Xueming Li To: Andrew Boyer CC: , dpdk stable Subject: patch 'net/ionic: fix mbuf double-free when emptying array' has been queued to stable release 23.11.2 Date: Mon, 12 Aug 2024 20:49:27 +0800 Message-ID: <20240812125035.389667-91-xuemingl@nvidia.com> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20240812125035.389667-1-xuemingl@nvidia.com> References: <20240712110153.309690-23-xuemingl@nvidia.com> <20240812125035.389667-1-xuemingl@nvidia.com> MIME-Version: 1.0 Content-Transfer-Encoding: 8bit Content-Type: text/plain X-Originating-IP: [10.126.231.35] X-ClientProxiedBy: rnnvmail201.nvidia.com (10.129.68.8) To rnnvmail201.nvidia.com (10.129.68.8) X-EOPAttributedMessage: 0 X-MS-PublicTrafficType: Email X-MS-TrafficTypeDiagnostic: BL02EPF0001A0FE:EE_|SJ2PR12MB8182:EE_ X-MS-Office365-Filtering-Correlation-Id: 582e9387-a0d3-4b71-fcd5-08dcbace9ec7 X-MS-Exchange-SenderADCheck: 1 X-MS-Exchange-AntiSpam-Relay: 0 X-Microsoft-Antispam: BCL:0; ARA:13230040|36860700013|376014|82310400026|1800799024; X-Microsoft-Antispam-Message-Info: =?us-ascii?Q?Me4vEWExNNeYi5Ltj+8Se5nuNOimbONcBCSPPE+tENjB3jq4gNnieE53nouz?= =?us-ascii?Q?0c0OY6AUN7WuQMV+n/imVF0qC5u7AW6gNz4VvX4uSGek0BU/kEq8iDTIELPo?= =?us-ascii?Q?9wh5cD6dvkx1IeRi4B9a/W34VHyhBh69wizeWOfWrkaWjNtgTqNMn4tb+Whj?= =?us-ascii?Q?RkLdVuka9+ynQgoQPk24Qyd5TJMNIWYgepPh7k+2ZKfDvqQAnfRJjcY42ThX?= =?us-ascii?Q?AQAsgGM57lz/ExTsjmWECI3nryTz0fOdflu8rf8RzHOgNCoj7jNOWqLiL9Sz?= =?us-ascii?Q?sVzLgckjVc65j1DwW5m1vIVQnlZRPFu4lqaghyw4ZPxdM8G3WHI8KmAcH38G?= =?us-ascii?Q?T0Mg4DbX/swuZrmZrQtol68RNwWsAUHSMfvhgw7Lmou4WyRFPl/DsYcvEqw7?= =?us-ascii?Q?z+DXlBBfp7i3Cjeq0jFBxN/BQxQj6ca3t7DjJelcqaovujl4sf1ABzXhD0SS?= =?us-ascii?Q?HQSF2gNqngaPbwLg0PRbKulXMinKyFme56HkCS/cjG1rzcuqDILwJShispsp?= =?us-ascii?Q?ibpg2FyyOLMU5GJPzfqDXFpRn29laedHXUVVud6Tw+Z8ZDoaPOr96ZZkSq0W?= =?us-ascii?Q?gaSst9PwXJjn8Rbn1/Q+MR+vVIurrRsHgN5N0tIhZPcIbYAmOmhzhYgGHtoJ?= =?us-ascii?Q?kUZ3OOZq720i3YwRq5pNSMfOfiHMNRKbR4NduHe3LjlCStg/DU91Bm4kne0z?= =?us-ascii?Q?DwWJ/1cuGx8RDNP/YKMbV1T8IW5J2ztjwHhI1bVh0ytIBTb56iJzxIMWDY6/?= =?us-ascii?Q?bsi1aQ0yuYwn03zv2wjPXJ+h58NBodOKTAE6ztKAqOnTmDXIfpWNr6mH/BsE?= =?us-ascii?Q?Qk/BvMeYA/8QerMiznZx1pcjI2bSLqgdnuR2ipfvIGPaaOQXz0IOOHOh34Ks?= =?us-ascii?Q?8Q9hkzkFYxNBIOTz4IjZjlf0+LwEHtd7mFBKBdpBfSckqyeUWtFEjb4cHeFv?= =?us-ascii?Q?KvHjRjiIyITXOcLhHQbU+nL0XJErFVYe3mf9cnz8AHakcUWVQLMjpqDB1p+i?= =?us-ascii?Q?Rz8rMjOEAG+HaTo6ESCnsCZ2hbixnYXtN0Mw+iZHmORpNWYWEUTHzs8TwZS6?= =?us-ascii?Q?7/J+6kHHkzifSIoJfxe3pWkD5/ugntylLfagNUWFEwGpq25roZ7QeW6PCS6c?= =?us-ascii?Q?n7zDpgkjWYi71/cYhJtksR+6f0wJ6vnm8l/1ANHeng5vtx1nviku+6pTtpUI?= =?us-ascii?Q?+2/qeYOsF/QaXkTzrbpSncaRxEX0m+gnidp+nSdHf8MjjcSY2cHjDtgNrl43?= =?us-ascii?Q?MoMFb0eFbjBFdrol06elR7EXEzr0sm3A2oVhRxLdJDuqbbtRoqupOrbxeBbC?= =?us-ascii?Q?4orrNaKYq2YNLWwE3AMxTIe1E96wmIcI1PTFwHs2ysfjnUyZ0rsegZFZuWvo?= =?us-ascii?Q?Yx1kOaaXkfR0SFnFfOGtS/AMLhairJrbEjGi0u2uiblXJioVow=3D=3D?= X-Forefront-Antispam-Report: CIP:216.228.117.160; CTRY:US; LANG:en; SCL:1; SRV:; IPV:NLI; SFV:NSPM; H:mail.nvidia.com; PTR:dc6edge1.nvidia.com; CAT:NONE; SFS:(13230040)(36860700013)(376014)(82310400026)(1800799024); DIR:OUT; SFP:1101; X-OriginatorOrg: Nvidia.com X-MS-Exchange-CrossTenant-OriginalArrivalTime: 12 Aug 2024 12:59:36.7672 (UTC) X-MS-Exchange-CrossTenant-Network-Message-Id: 582e9387-a0d3-4b71-fcd5-08dcbace9ec7 X-MS-Exchange-CrossTenant-Id: 43083d15-7273-40c1-b7db-39efd9ccc17a X-MS-Exchange-CrossTenant-OriginalAttributedTenantConnectingIp: TenantId=43083d15-7273-40c1-b7db-39efd9ccc17a; Ip=[216.228.117.160]; Helo=[mail.nvidia.com] X-MS-Exchange-CrossTenant-AuthSource: BL02EPF0001A0FE.namprd03.prod.outlook.com X-MS-Exchange-CrossTenant-AuthAs: Anonymous X-MS-Exchange-CrossTenant-FromEntityHeader: HybridOnPrem X-MS-Exchange-Transport-CrossTenantHeadersStamped: SJ2PR12MB8182 X-BeenThere: stable@dpdk.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: patches for DPDK stable branches List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: stable-bounces@dpdk.org Hi, FYI, your patch has been queued to stable release 23.11.2 Note it hasn't been pushed to http://dpdk.org/browse/dpdk-stable yet. It will be pushed if I get no objections before 08/14/24. So please shout if anyone has objections. Also note that after the patch there's a diff of the upstream commit vs the patch applied to the branch. This will indicate if there was any rebasing needed to apply to the stable branch. If there were code changes for rebasing (ie: not only metadata diffs), please double check that the rebase was correctly done. Queued patches are on a temporary branch at: https://git.dpdk.org/dpdk-stable/log/?h=23.11-staging This queued commit can be viewed at: https://git.dpdk.org/dpdk-stable/commit/?h=23.11-staging&id=c22c079e1c293d0fc1b8273e0ec47d2f0d577e87 Thanks. Xueming Li --- >From c22c079e1c293d0fc1b8273e0ec47d2f0d577e87 Mon Sep 17 00:00:00 2001 From: Andrew Boyer Date: Mon, 1 Jul 2024 08:19:43 -0700 Subject: [PATCH] net/ionic: fix mbuf double-free when emptying array Cc: Xueming Li [ upstream commit d46b9fa83f136beb0e6feedd0a7b3a228b0d8cd3 ] The bulk-allocation array is used back to front, so we need to free everything before the marker, not after it. Flip ionic_empty_array() so that it frees from 0 to the provided index. Adjust the callers as needed. Fixes: 218afd825bca ("net/ionic: do bulk allocations of Rx mbufs") Signed-off-by: Andrew Boyer --- drivers/net/ionic/ionic_rxtx.c | 16 +++++++++------- 1 file changed, 9 insertions(+), 7 deletions(-) diff --git a/drivers/net/ionic/ionic_rxtx.c b/drivers/net/ionic/ionic_rxtx.c index 2f1ca986b3..170d3b0802 100644 --- a/drivers/net/ionic/ionic_rxtx.c +++ b/drivers/net/ionic/ionic_rxtx.c @@ -26,38 +26,40 @@ #include "ionic_logs.h" static void -ionic_empty_array(void **array, uint32_t cnt, uint16_t idx) +ionic_empty_array(void **array, uint32_t free_idx, uint32_t zero_idx) { uint32_t i; - for (i = idx; i < cnt; i++) + for (i = 0; i < free_idx; i++) if (array[i]) rte_pktmbuf_free_seg(array[i]); - memset(array, 0, sizeof(void *) * cnt); + memset(array, 0, sizeof(void *) * zero_idx); } static void __rte_cold ionic_tx_empty(struct ionic_tx_qcq *txq) { struct ionic_queue *q = &txq->qcq.q; + uint32_t info_len = q->num_descs * q->num_segs; - ionic_empty_array(q->info, q->num_descs * q->num_segs, 0); + ionic_empty_array(q->info, info_len, info_len); } static void __rte_cold ionic_rx_empty(struct ionic_rx_qcq *rxq) { struct ionic_queue *q = &rxq->qcq.q; + uint32_t info_len = q->num_descs * q->num_segs; /* * Walk the full info array so that the clean up includes any * fragments that were left dangling for later reuse */ - ionic_empty_array(q->info, q->num_descs * q->num_segs, 0); + ionic_empty_array(q->info, info_len, info_len); - ionic_empty_array((void **)rxq->mbs, - IONIC_MBUF_BULK_ALLOC, rxq->mb_idx); + ionic_empty_array((void **)rxq->mbs, rxq->mb_idx, + IONIC_MBUF_BULK_ALLOC); rxq->mb_idx = 0; } -- 2.34.1 --- Diff of the applied patch vs upstream commit (please double-check if non-empty: --- --- - 2024-08-12 20:44:05.453436265 +0800 +++ 0090-net-ionic-fix-mbuf-double-free-when-emptying-array.patch 2024-08-12 20:44:02.355069346 +0800 @@ -1 +1 @@ -From d46b9fa83f136beb0e6feedd0a7b3a228b0d8cd3 Mon Sep 17 00:00:00 2001 +From c22c079e1c293d0fc1b8273e0ec47d2f0d577e87 Mon Sep 17 00:00:00 2001 @@ -4,0 +5,3 @@ +Cc: Xueming Li + +[ upstream commit d46b9fa83f136beb0e6feedd0a7b3a228b0d8cd3 ] @@ -12 +14,0 @@ -CC: stable@dpdk.org @@ -20 +22 @@ -index 923f517661..339b20f113 100644 +index 2f1ca986b3..170d3b0802 100644